What Maintenance does on your site
Maintenance replaces the public view of your site with a single “under maintenance” page while its switch is on. Logged-in users, whatever their role, keep seeing the normal site, and the admin toolbar shows the maintenance status along with a preview link. The login and admin URLs stay reachable, so you can work on the site while visitors see the holding page.
The page is built from modules (logo, header, content, footer) that you arrange by drag and drop, over an image or YouTube video background, with your own colors, fonts and custom CSS. The SEO tab also offers a 503 option, meant to return a “Service Unavailable” status with a one-hour Retry-After header so search engines know the outage is temporary. Fonts load from Bunny Fonts rather than Google Fonts, and nothing is sent to a third party unless you use a web font or Google Analytics.
Listed on WordPress.org since 2012 as “Maintenance” and sold as WP Maintenance, the plugin belongs to WebFactory Ltd, which also makes WP Force SSL and Advanced Google reCAPTCHA. Version 4.30 (June 2026) rebuilt the interface. The PRO version, a one-time purchase, unlocks ready-made themes, advanced modules (countdown, form, map, social icons) and the access options.
When Maintenance is the right way to close your site
The free version is enough for a short, planned outage:
- Theme redesign, migration or a major update: visitors see a clean page while you work logged in.
- Business site or blog under construction: a holding page with a logo and some text, without a form or countdown, takes minutes to set up.
- Partial closure: the URL Based Rules keep some pages open, or close only a few of them.
It is the wrong tool if your content must stay private: the free version only acts on how pages are displayed, not on the REST API or RSS feeds. For long projects, a staging copy spares you from closing the site at all. And if you want a full launch page that collects email addresses, SeedProd does more.
Maintenance strengths and limitations
Strengths
- One switch, nothing more. Maintenance mode turns on from the plugin screen or the toolbar, and logged-in users still see the normal site.
- Preview before going live. The “Preview Maintenance Page” button and the toolbar show the page without closing the site.
- URL rules included. You can exclude pages from maintenance mode, or close only a handful of them.
- Few outside dependencies. Bunny Fonts replaces Google Fonts, and no third-party service is called without a web font or Analytics.
Limitations
- Client access costs extra. IP whitelisting, the secret access link and password protection are PRO only.
- Fixed meta description. The free version outputs the default description; editing it requires PRO.
- Only the display is blocked. The REST API and RSS feeds keep publishing your content during maintenance.
- Advanced modules cost extra. Countdown, form, video, map, social icons and custom HTML are PRO only.
- Outdated Analytics field. It expects a “UA-” Universal Analytics ID, which Google stopped processing in July 2023.
The settings we recommend for Maintenance
All of these settings exist in the current free version, under the Maintenance menu in the dashboard. Build the page before you flip the switch, then save each tab.
| Setting | Recommended value | Why |
|---|---|---|
| “Maintenance” switch Maintenance, top of the screen | Off until the page is ready | The “Preview Maintenance Page” button shows the page without closing the site. |
| Enable 503 (Service Unavailable) status code Maintenance > SEO | On, then check the response code | Without a 503 the page answers 200 like a normal page that can be indexed. |
| SEO Title Maintenance > SEO | A clear title, such as %sitetitle% is down for maintenance | The title shows in browser tabs and link previews. |
| Google Analytics Tracking ID Maintenance > SEO | Empty | The script it loads is Universal Analytics, which no longer collects anything. |
| Header and Content modules Maintenance > Design > Layout | Your own text, with the expected duration | A return date reassures visitors far more than a generic message. |
| URL Based Rules and URL List Maintenance > Access | “Listed URLs will NEVER be affected” if some pages must stay open | Legal or contact pages stay available; one URL per line, between two slashes. |
| Show Login Button Maintenance > Access | Off if you know your login URL | On by default, it adds a button to the maintenance page that opens a login form. |
- After turning it on, open the site in a private window: while logged in, you always see the normal site.
- Check the page’s HTTP response code in the Network tab of your browser’s developer tools or with an online header checker: search engines should get a 503.
- Purge the page cache (plugin or host) every time you switch maintenance on or off: a cached page can keep showing.
- If the content must not leak, open
/wp-json/wp/v2/posts: the list of posts is still public (see our article on what the REST API exposes). - When the work is done, switch it off: the toolbar shows the status at all times so you don’t forget.
Maintenance security: a single published flaw
To date, only one flaw in the plugin has received a CVE ID: CVE-2021-24533, fixed in 4.03. Some settings were neither sanitized nor escaped, so an administrator could store a script that then ran on the public page, even on a site that denies them the right to post raw HTML. It is a stored XSS vulnerability that requires an administrator account, so the risk is low. The changelog also mentions “security fixes” in 4.05 and 4.13 with no public ID.
Watch out for look-alikes: another plugin, “WP Maintenance” by Florent Maillefaud, has had several vulnerabilities in its 6.x versions, and they do not affect the WebFactory plugin. Keep the plugin up to date, ideally with automatic plugin updates, and delete it between projects if you no longer use it. WP Masquerade Pro removes some of Maintenance’s traces from your page code, which makes it harder for bots to spot, without replacing updates.
What WP Masquerade hides for Maintenance (WP Maintenance)
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to Maintenance (WP Maintenance): without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
Still visible
- JavaScript variables
mtnc_front_options
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
Maintenance FAQ
I turned Maintenance on but my site still looks normal. Why?
You are logged in, and logged-in users always see the normal site. Open it in a private window or another browser, and purge the page cache if you have one.
Does maintenance mode hurt SEO?
It can if the maintenance page answers with a 200 status: it then looks like a normal page and may replace your content in search results. The 503 option exists to signal a temporary outage; turn it on and check the code actually returned.
How can I show the site to a client during maintenance?
With the free version, create a WordPress account for them with the Subscriber role: once logged in, they see the normal site. PRO adds a secret access link, an IP whitelist and an access password.
How much does WP Maintenance PRO cost?
The official site lists one-time lifetime licenses: $59 for one site, $69 for five sites and $119 for 100 sites, shown as discounted prices. The Agency license, for 100 sites, also lets you rebrand the plugin for your clients.